CVE-2022-2022

MEDIUM

Cross-site Scripting (XSS) - Stored in nocodb/nocodb

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-2022 has a selected CVSS score of 5.4 (medium); EIP currently links 27 repository PoCs and 1 lab environment.

Description

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
27
Lab environments
1

Affected products and versions

1
ProductSourceVersion range

nocodb/nocodb

Browse nocodb / nocodb/nocodb
CVE ListBefore 0.91.7affected

Proofs of concept

Showing 12 of 27

Repository PoCs

GitHubacheong08/CVE-2022-26726-POCRepository PoCby acheong0820Not analyzed4 files

51.7 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubcorelight/CVE-2022-24491Repository PoCby corelight3Not analyzed20 files

155.6 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubund3sc0n0c1d0/CVE-2022-1292Repository PoCby und3sc0n0c1d07Not analyzed2 files

2.5 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubstepancar-web-programming/2022-fall-lab-portfolio-cvetkov-vyacheslav-andreevichRepository PoCby stepancar-web-programming0Not analyzed33 files

2.4 MiB

GitHub
PoC details
GitHubmaikroservice/CVE-2022-45265Repository PoCby maikroservice0Not analyzed1 file

348 B · linked to 2 vulnerabilities

GitHub
PoC details
GitHubalfarom256/CVE-2022-3699Repository PoCby alfarom256175Not analyzed9 files

78.6 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHub0xmaximus/Home-DemolisherRepository PoCby 0xmaximus8Not analyzed4 files

6.1 KiB · linked to 3 vulnerabilities

GitHub
PoC details
GitHubclemoregan/SSE4-CVE-2022-22965Repository PoCby clemoregan1Not analyzed25 files

63.0 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubmgregus/project_BIT_nmap_scriptRepository PoCby mgregus3Not analyzed7 files

773.7 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubsudoninja-noob/CVE-2022-43369Repository PoCby sudoninja-noob1Not analyzed1 file

1.1 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubsudoninja-noob/CVE-2022-45217Repository PoCby sudoninja-noob1Not analyzed1 file

1.1 KiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubrevanmalang/CVE-2022-1388Repository PoCby revanmalang3Not analyzed5 files

62.8 KiB · linked to 2 vulnerabilities

GitHub
PoC details

Search the exploit catalog for CVE-2022-2022

Docker lab environments

1
GitHub

docker-compose.yml

ps-interactive/lab_security_apache_spark_emulation_detectionCreated Vuln labCVE-2022-2022CVE-2022-33891Compose · images

1 Compose manifest · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A lab environment that deploys a vulnerable Apache Spark 3.1.1 instance behind an Apache reverse proxy with ModSecurity, designed to demonstrate CVE-2022-33891.

install.sh:1-365

Lab assessment

Vulnerability lab

The install script explicitly states it is installing a CVE-2022-33891 lab, sets up a vulnerable Spark configuration, and configures Apache with ModSecurity rules referencing the CVE.

install.sh:1install.sh:56-57install.sh:155-156
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

spark

vulnerable target

Apache Spark 3.1.1 master node from Bitnami, configured with ACLs enabled and authentication/encryption disabled, exposed on host ports 8080 (localhost) and 443.

docker-compose.yml:3-12install.sh:56-57

apache

reverse proxyweb application firewall

Apache HTTP server acting as a reverse proxy to the Spark instance on port 8080, with ModSecurity configured in DetectionOnly mode and rules referencing CVE-2022-33891.

install.sh:100-101install.sh:155-156install.sh:160-161
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-2022

Insufficient evidence

No evidence in the supplied files references or describes CVE-2022-2022; it appears only in the repository claim list.

CVE-2022-33891

Supported by supplied evidence

The install script explicitly names CVE-2022-33891, configures a vulnerable Spark version, and includes ModSecurity rules designed to detect exploitation of the CVE via the doAs parameter.

install.sh:1install.sh:155-156install.sh:160-161
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed on the host.install.sh:18-19
  • The host must have internet access to pull the Bitnami Spark image and install packages via apt.install.sh:3install.sh:18-19
  • The install script must be executed with sufficient privileges (sudo) to install packages, configure Docker, and modify system files.install.sh:12

Evidence-described exercise path

  1. Run install.sh to set up the vulnerable Spark container and Apache reverse proxy with ModSecurity detection rules.install.sh:1-365
  2. Send a crafted HTTP request to the Apache proxy (port 80) with a malicious doAs query parameter to trigger the Spark command injection vulnerability (CVE-2022-33891).install.sh:155-156install.sh:160-161
  3. Observe ModSecurity audit logs for detection of the attack, and optionally modify rules to block or prevent exploitation.install.sh:155-161
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at setting up and exercising the vulnerability lab. The Spark container is bound to localhost for port 8080, and port 443 is mapped for a bind-shell exercise. No hidden, destructive, or externally reaching behavior is observed.

docker-compose.yml:10-12install.sh:1-365
Review boundaries

What the analysis did not establish

  • The packet does not include the actual exploit payload or proof-of-concept code.
  • The ModSecurity rules are commented out by default, so the detection/prevention behavior is not active without manual modification.
  • CVE-2022-2022 is claimed by the repository but has no supporting evidence in the supplied files.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3